fix(chart): use DB_POSTGRESDB_SSL_ENABLED to enable Postgres TLS

[b3go]

Pull Request

Description

n8n reads DB_POSTGRESDB_SSL_ENABLED, not DB_POSTGRESDB_SSL, so database.ssl.enabled had no effect on its own and the connection quietly stayed plaintext.

This likely went unnoticed because n8n also switches SSL on whenever DB_POSTGRESDB_SSL_CA or _CERT is set, and the chart emits those correctly.

Type of Change

• Bug fix (non-breaking change which fixes an issue)

Changes Made

• Renamed the ConfigMap key in configmap.yaml and the env var referencing it in _configmap-env.tpl from DB_POSTGRESDB_SSL to DB_POSTGRESDB_SSL_ENABLED.

Testing Performed

Rendered with database.ssl.enabled=true and no client certs. Before no SSL variable n8n reads was emitted. With the change: DB_POSTGRESDB_SSL_ENABLED=true is present in the ConfigMap and injected into main, worker and webhook-processor.

Chart Validation

• helm lint charts/n8n passes
  - [ ] ./scripts/validate-examples.sh passes -> this doesn't exist
• Template rendering works with all examples

Breaking Changes

database.ssl.enabled keeps its name and meaning, and DB_POSTGRESDB_SSL is not read by n8n, so no working configuration depends on it. Deployments already getting TLS via ssl.ca/ssl.cert are unaffected but those that were silently running plaintext will now genuinely negotiate TLS on upgrade.

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• My changes generate no new warnings or errors
• I have added examples that demonstrate the changes (if applicable)
• All new and existing tests pass

---

Summary by cubic

Fixes Postgres TLS enablement in the n8n chart by emitting DB_POSTGRESDB_SSL_ENABLED when database.ssl.enabled=true. Instances that were silently using plaintext will now negotiate TLS as expected.

• Bug Fixes
  • Renamed ConfigMap key and env var from DB_POSTGRESDB_SSL to DB_POSTGRESDB_SSL_ENABLED in configmap.yaml and _configmap-env.tpl.
  • Verified rendering: DB_POSTGRESDB_SSL_ENABLED=true is injected into main, worker, and webhook-processor; helm lint passes.

^{Written for commit 5e74d79. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 2 files

Architecture diagram

sequenceDiagram
    participant Helm as Helm Values
    participant CM as ConfigMap
    participant Env as Container Environment
    participant n8n as n8n Process
    participant Postgres as PostgreSQL

    Note over Helm,Postgres: Postgres TLS configuration flow

    Helm->>CM: database.ssl.enabled=true
    alt NEW: DB_POSTGRESDB_SSL_ENABLED key emitted
        CM->>CM: Set DB_POSTGRESDB_SSL_ENABLED="true"
    else OLD: DB_POSTGRESDB_SSL emitted (not read by n8n)
        Note over CM: Bug: wrong key name caused silent plaintext
    end

    opt ssl.ca or ssl.cert also set
        Helm->>CM: database.ssl.ca / database.ssl.cert
        CM->>CM: Set DB_POSTGRESDB_SSL_CA / DB_POSTGRESDB_SSL_CERT
    end

    CM->>Env: Inject environment variables
    Env->>n8n: DB_POSTGRESDB_SSL_ENABLED=true

    n8n->>n8n: Read DB_POSTGRESDB_SSL_ENABLED
    alt TLS enabled
        n8n->>Postgres: Connect with TLS
        Postgres-->>n8n: Encrypted connection
    else TLS disabled
        n8n->>Postgres: Connect without TLS
        Postgres-->>n8n: Plaintext connection
    end

    opt ssl.ca present
        n8n->>Postgres: Use CA certificate for validation
    end

Loading

_{Re-trigger cubic}